runline 0.29.0 → 0.30.1

package/dist/core/engine.js

@@ -1,8 +1,9 @@
 import { randomUUID } from "node:crypto";
 import { createRequire } from "node:module";
 import { Worker } from "node:worker_threads";
-import { applyEnvOverrides, updateConnectionConfig } from "../config/loader.js";
+import { MemoryConnectionProvider } from "../connections/memory.js";
 import { formatValidationError, helpInputs, isTypedInputSchema, normalizeActionInput, validateTypedInput, } from "../plugin/schema.js";
+import { notifyObserver } from "../utils/observer.js";
 /**
  * How many bodies one worker may run before it is retired.
  *
@@ -89,12 +90,16 @@ export class ExecutionEngine {
     registry;
     config;
     hooks;
+    connectionProvider;
     pooled = null;
     maxRunsPerWorker;
     constructor(registry, config, hooks = {}) {
         this.registry = registry;
         this.config = config;
         this.hooks = hooks;
+        this.connectionProvider =
+            hooks.connectionProvider ??
+                new MemoryConnectionProvider(config.connections);
         this.maxRunsPerWorker =
             config.maxRunsPerWorker ?? DEFAULT_MAX_RUNS_PER_WORKER;
     }
@@ -338,7 +343,23 @@ export class ExecutionEngine {
             throw new Error(`Unknown action: ${path}${this.selfPrefixHint(path)}`);
         }
         const { plugin, action } = resolved;
-        const connection = this.resolveConnection(plugin);
+        if (isTypedInputSchema(action.inputSchema)) {
+            const validation = validateTypedInput(action.inputSchema, args);
+            if (!validation.ok) {
+                throw new Error(formatValidationError(path, validation));
+            }
+        }
+        const handle = await this.connectionProvider.resolve({
+            plugin: plugin.name,
+            action: action.name,
+            schema: plugin.connectionConfigSchema,
+            context,
+        });
+        const connection = structuredClone(await handle.read());
+        if (connection.plugin !== plugin.name) {
+            throw new Error(`Connection provider returned the wrong plugin for ${path}`);
+        }
+        const connectionName = connection.name;
         const ctx = {
             connection,
             context,
@@ -347,19 +368,15 @@ export class ExecutionEngine {
                 warn: (msg) => console.warn(`[${plugin.name}] ${msg}`),
                 error: (msg) => console.error(`[${plugin.name}] ${msg}`),
             },
-            updateConnection: async (patch) => {
-                // Mutate the in-memory copy so the rest of this action
-                // sees the new values without re-reading disk.
-                Object.assign(connection.config, patch);
-                await updateConnectionConfig(connection.name, patch);
+            updateConnection: async (change) => {
+                const committed = await handle.update(change);
+                if (committed.plugin !== plugin.name ||
+                    committed.name !== connectionName) {
+                    throw new Error(`Connection provider changed identity during update for ${path}`);
+                }
+                connection.config = structuredClone(committed.config);
             },
         };
-        if (isTypedInputSchema(action.inputSchema)) {
-            const validation = validateTypedInput(action.inputSchema, args);
-            if (!validation.ok) {
-                throw new Error(formatValidationError(path, validation));
-            }
-        }
         const started = performance.now();
         try {
             const value = await action.execute(args, ctx);
@@ -374,21 +391,13 @@ export class ExecutionEngine {
         }
     }
     fireOnAction(pluginName, actionName, path, started, failed, error) {
-        const onAction = this.hooks.onAction;
-        if (!onAction)
-            return;
-        try {
-            onAction({
-                plugin: pluginName,
-                action: actionName,
-                path,
-                durationMs: performance.now() - started,
-                ...(failed ? { error: error ?? new Error("Unknown error") } : {}),
-            });
-        }
-        catch {
-            // Observability never breaks a run.
-        }
+        notifyObserver(this.hooks.onAction, {
+            plugin: pluginName,
+            action: actionName,
+            path,
+            durationMs: performance.now() - started,
+            ...(failed ? { error: error ?? new Error("Unknown error") } : {}),
+        });
     }
     /**
      * A miss on "salesforce.status" is often a plugin that registered
@@ -409,15 +418,6 @@ export class ExecutionEngine {
             `action name with the plugin prefix ("${path}"), so the full callable ` +
             `path is "${doubled}".`);
     }
-    resolveConnection(plugin) {
-        const conn = this.config.connections.find((c) => c.plugin === plugin.name);
-        const base = conn ?? {
-            name: "default",
-            plugin: plugin.name,
-            config: {},
-        };
-        return applyEnvOverrides(base, plugin.connectionConfigSchema);
-    }
 }
 // ── Helpers ──────────────────────────────
 /**
@@ -433,9 +433,8 @@ function newRunId() {
     return randomUUID();
 }
 /**
- * JSON round-trip to (a) guarantee structured-clone compatibility and
- * (b) preserve the previous engine's value semantics, where every action
- * result crossed a JSON boundary (Dates → ISO strings, no Maps, etc.).
+ * Action results cross a JSON boundary (Dates → ISO strings, no Maps).
+ * The round-trip also guarantees structured-clone compatibility.
  */
 function toPlainJson(value) {
     if (value === undefined)
@@ -453,8 +452,8 @@ function formatError(cause) {
     }
     return String(cause);
 }
-// ferrosearch is a Rust native addon, so unlike the old minisearch UMD it
-// cannot be inlined into the worker source as text. Resolve its entry point
+// ferrosearch is a Rust native addon and cannot be inlined as worker source.
+// Resolve its entry point
 // host-side and require it by absolute path inside the worker: eval'd worker
 // code gets a cwd-relative `require`, so a bare specifier would resolve
 // against the caller's cwd instead of runline's own node_modules.
@@ -495,10 +494,8 @@ export function buildRunBody(code) {
 }
 function buildWorkerSource(pluginNames = [], helpData = {}) {
     // Injected into every body's scope. `require` is here because bodies are
-    // compiled with `new Function`, whose scope is the worker's *global* object
-    // — not the module scope that used to hold the inlined body. Without it,
-    // pooling would silently revoke a documented capability ("agent code gets
-    // the full host JS runtime") as a side effect of a memory fix.
+    // compiled with `new Function`, whose scope is the worker's global object.
+    // Explicit injection gives bodies access to the host JS runtime.
     const injectNames = [
         ...pluginNames,
         "actions",
@@ -596,9 +593,8 @@ const __fmtErr = (e) => {
 const __toJson = (v) => v === undefined ? undefined : JSON.parse(JSON.stringify(v));
 
 // ferrosearch native addon, resolved to an absolute path by the host. Its
-// index memory lives outside the V8 heap, which is the point — minisearch's
-// JS index counted against maxOldGenerationSizeMb and grew worker RSS — but
-// also means an index built by agent code is invisible to that limit.
+// index memory lives outside the V8 heap. An index built by agent code is
+// therefore invisible to maxOldGenerationSizeMb.
 const { FerroSearch } = require(${JSON.stringify(ferrosearchPath)});
 
 // The host's own validator, for actions.check on typed schemas.
@@ -936,12 +932,9 @@ const __scrubGlobals = () => {
 
 // The host channel is the one capability a body must not hold.
 //
-// A body can require("node:worker_threads"). Before pooling that was
-// harmless: anything it attached died with the worker after a single run.
-// Under reuse a surviving listener sees the {t:"run", runId} of EVERY later
-// body and can post a forged "done" for it, handing that run attacker-chosen
-// output. Randomising the run id does not help — the listener is simply told
-// what it is.
+// A surviving parentPort listener sees the {t:"run", runId} of every later
+// body and can forge its "done" message. Random run IDs alone cannot protect
+// a channel that exposes those IDs to the body.
 //
 // Bun's MessagePort exposes no listenerCount/removeAllListeners, so listeners
 // cannot be enumerated and stripped after the fact. Instead the route in is

package/dist/core/oauth.d.ts

@@ -22,7 +22,9 @@
  *    wants (redirect-URI paste, browser popup with postMessage,
  *    public HTTPS callback, …), calls exchangeAuthCode.
  */
+import type { OAuthTokens } from "../auth/types.js";
 import type { OAuthConfig } from "../plugin/types.js";
+export type { OAuthTokens } from "../auth/types.js";
 /**
  * Fixed callback port for OAuth redirects. Pinned so users can
  * register `http://127.0.0.1:<PORT>/callback` once with the
@@ -34,24 +36,26 @@ import type { OAuthConfig } from "../plugin/types.js";
 export declare const OAUTH_CALLBACK_PORT: number;
 /** Canonical localhost redirect URI for CLI-based flows. */
 export declare const OAUTH_CALLBACK_URI: string;
-export interface OAuthTokens {
-    accessToken: string;
-    refreshToken: string;
-    /** Milliseconds since epoch. */
-    expiresAt: number;
-    scope?: string;
-    tokenType?: string;
+interface Callback {
+    uri: string;
+    port: number;
+    path: string;
 }
+/** Only loopback HTTP callbacks are accepted; the flow never listens on other interfaces. */
+export declare function oauthCallback(config: OAuthConfig): Callback;
 export interface RunOAuthOptions {
     clientId: string;
-    clientSecret: string;
+    /** Omitted for public clients; PKCE protects the exchange instead. */
+    clientSecret?: string;
     /**
      * Called with the consent URL before the browser is opened.
      * Lets the CLI print a clickable link in case auto-open fails.
      */
-    onAuthUrl?: (url: string) => void;
+    onAuthUrl?: (url: string) => void | Promise<void>;
     /** Override the browser launcher. Defaults to OS-appropriate command. */
-    openBrowser?: (url: string) => void;
+    openBrowser?: (url: string) => void | Promise<void>;
+    /** Maximum wait for browser consent. Defaults to five minutes. */
+    callbackTimeoutMs?: number;
 }
 export interface BuildAuthUrlOptions {
     clientId: string;
@@ -62,11 +66,13 @@ export interface BuildAuthUrlOptions {
 }
 export interface ExchangeCodeOptions {
     clientId: string;
-    clientSecret: string;
+    clientSecret?: string;
     code: string;
     redirectUri: string;
     /** PKCE verifier matching the challenge sent on the auth URL. */
     codeVerifier?: string;
+    /** Host-validated state; sent only when the provider protocol requires it. */
+    state?: string;
 }
 export interface PKCEPair {
     verifier: string;
@@ -85,15 +91,14 @@ export declare function generatePKCE(): PKCEPair;
  */
 export declare function buildAuthUrl(config: OAuthConfig, opts: BuildAuthUrlOptions): string;
 /**
- * Exchange an authorization code for tokens. Throws if the
- * provider doesn't return a refresh_token — that's almost always a
- * misconfiguration (e.g. missing `access_type=offline` for Google).
+ * Exchange an authorization code using the shared OAuth2 protocol runtime.
+ * Refresh tokens and expiry are optional provider capabilities.
  */
 export declare function exchangeAuthCode(config: OAuthConfig, opts: ExchangeCodeOptions): Promise<OAuthTokens>;
 /**
  * Run the full OAuth2 authorization-code flow end-to-end.
  * Resolves with the exchanged tokens once the user completes the
- * browser consent and the token endpoint returns a refresh token.
+ * browser consent and the token endpoint returns a valid access token.
  *
  * Uses the pinned localhost callback port. If you can't run a
  * local callback server, drive the flow yourself with

package/dist/core/oauth.js

@@ -25,6 +25,8 @@
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
 import { createServer, } from "node:http";
+import { AuthError } from "../auth/errors.js";
+import { buildOAuth2AuthorizationUrl, exchangeOAuth2Code, } from "../auth/oauth2.js";
 /**
  * Fixed callback port for OAuth redirects. Pinned so users can
  * register `http://127.0.0.1:<PORT>/callback` once with the
@@ -44,6 +46,64 @@ export const OAUTH_CALLBACK_PORT = (() => {
 })();
 /** Canonical localhost redirect URI for CLI-based flows. */
 export const OAUTH_CALLBACK_URI = `http://127.0.0.1:${OAUTH_CALLBACK_PORT}/callback`;
+/** Browsers resolve `localhost` to either family; IPv6 may be unavailable. */
+const LOOPBACK_HOSTS = ["127.0.0.1", "::1"];
+const IPV6_UNAVAILABLE = new Set([
+    "EAFNOSUPPORT",
+    "EADDRNOTAVAIL",
+    "EINVAL",
+    "EPROTONOSUPPORT",
+]);
+/** Only loopback HTTP callbacks are accepted; the flow never listens on other interfaces. */
+export function oauthCallback(config) {
+    if (config.redirectUri === undefined)
+        return {
+            uri: OAUTH_CALLBACK_URI,
+            port: OAUTH_CALLBACK_PORT,
+            path: "/callback",
+        };
+    let url;
+    try {
+        url = new URL(config.redirectUri);
+    }
+    catch {
+        throw new AuthError("invalid_definition");
+    }
+    const port = Number(url.port);
+    if (url.protocol !== "http:" ||
+        !["localhost", "127.0.0.1", "[::1]"].includes(url.hostname) ||
+        !Number.isInteger(port) ||
+        port <= 0 ||
+        url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        url.pathname === "/")
+        throw new AuthError("invalid_definition");
+    return { uri: url.toString(), port, path: url.pathname };
+}
+/** Plugin OAuth declarations retain their body-auth default at the compatibility boundary. */
+function definition(config) {
+    if (config.protocol !== undefined) {
+        if (!config.protocol ||
+            config.authUrl !== undefined ||
+            config.tokenUrl !== undefined ||
+            config.authParams !== undefined)
+            throw new AuthError("invalid_definition");
+        return config.protocol;
+    }
+    if (config.publicClient)
+        throw new AuthError("invalid_definition");
+    return {
+        id: "plugin-oauth",
+        provider: "legacy",
+        authorization: { url: config.authUrl, parameters: config.authParams },
+        exchange: {
+            url: config.tokenUrl,
+            clientAuthentication: "client_secret_post",
+        },
+    };
+}
 // ─── Primitives ──────────────────────────────────────────────────
 /**
  * Generate a PKCE verifier and its SHA-256 challenge. The verifier
@@ -60,140 +120,178 @@ export function generatePKCE() {
  * Pass `pkceChallenge` to include PKCE; omit for plain auth-code.
  */
 export function buildAuthUrl(config, opts) {
-    const url = new URL(config.authUrl);
-    url.searchParams.set("client_id", opts.clientId);
-    url.searchParams.set("redirect_uri", opts.redirectUri);
-    url.searchParams.set("response_type", "code");
-    url.searchParams.set("scope", config.scopes.join(" "));
-    url.searchParams.set("state", opts.state);
-    if (opts.pkceChallenge) {
-        url.searchParams.set("code_challenge", opts.pkceChallenge);
-        url.searchParams.set("code_challenge_method", "S256");
-    }
-    for (const [k, v] of Object.entries(config.authParams ?? {})) {
-        url.searchParams.set(k, v);
-    }
-    return url.toString();
+    return buildOAuth2AuthorizationUrl(definition(config), {
+        application: { clientId: opts.clientId },
+        redirectUri: opts.redirectUri,
+        state: opts.state,
+        scopes: config.scopes,
+        pkceChallenge: opts.pkceChallenge,
+    });
 }
 /**
- * Exchange an authorization code for tokens. Throws if the
- * provider doesn't return a refresh_token — that's almost always a
- * misconfiguration (e.g. missing `access_type=offline` for Google).
+ * Exchange an authorization code using the shared OAuth2 protocol runtime.
+ * Refresh tokens and expiry are optional provider capabilities.
  */
 export async function exchangeAuthCode(config, opts) {
-    const body = new URLSearchParams({
+    const protocol = definition(config);
+    if (config.publicClient ? opts.clientSecret !== undefined : !opts.clientSecret)
+        throw new AuthError("invalid_credentials");
+    return exchangeOAuth2Code(protocol, {
+        application: { clientId: opts.clientId, clientSecret: opts.clientSecret },
         code: opts.code,
-        client_id: opts.clientId,
-        client_secret: opts.clientSecret,
-        redirect_uri: opts.redirectUri,
-        grant_type: "authorization_code",
-    });
-    if (opts.codeVerifier)
-        body.set("code_verifier", opts.codeVerifier);
-    const res = await fetch(config.tokenUrl, {
-        method: "POST",
-        headers: { "Content-Type": "application/x-www-form-urlencoded" },
-        body: body.toString(),
+        redirectUri: opts.redirectUri,
+        codeVerifier: opts.codeVerifier,
+        state: opts.state,
     });
-    if (!res.ok) {
-        throw new Error(`OAuth: token exchange failed (${res.status}): ${await res.text()}`);
-    }
-    const data = (await res.json());
-    if (!data.refresh_token) {
-        throw new Error("OAuth: provider did not return a refresh token. This usually means a prior consent is cached — revoke access with the provider and retry. For Google, set authParams: { access_type: 'offline', prompt: 'consent' }.");
-    }
-    return {
-        accessToken: data.access_token,
-        refreshToken: data.refresh_token,
-        expiresAt: Date.now() + data.expires_in * 1000,
-        scope: data.scope,
-        tokenType: data.token_type,
-    };
 }
 // ─── End-to-end CLI flow ─────────────────────────────────────────
 /**
  * Run the full OAuth2 authorization-code flow end-to-end.
  * Resolves with the exchanged tokens once the user completes the
- * browser consent and the token endpoint returns a refresh token.
+ * browser consent and the token endpoint returns a valid access token.
  *
  * Uses the pinned localhost callback port. If you can't run a
  * local callback server, drive the flow yourself with
  * `buildAuthUrl` + `exchangeAuthCode`.
  */
 export async function runOAuth(config, options) {
-    const redirectUri = OAUTH_CALLBACK_URI;
+    // Consent and exchange use the same detached setup snapshot.
+    let flowConfig;
+    try {
+        flowConfig = structuredClone(config);
+    }
+    catch {
+        throw new AuthError("invalid_definition");
+    }
+    const { clientId, clientSecret, onAuthUrl, openBrowser = defaultOpenBrowser, callbackTimeoutMs = 300_000, } = options;
+    const callback = oauthCallback(flowConfig);
+    const redirectUri = callback.uri;
     const state = randomState();
     const { verifier, challenge } = generatePKCE();
-    const authUrl = buildAuthUrl(config, {
-        clientId: options.clientId,
+    const authUrl = buildAuthUrl(flowConfig, {
+        clientId,
         redirectUri,
         state,
         pkceChallenge: challenge,
     });
-    // Always make the URL visible. `onAuthUrl` is the preferred
-    // channel (CLI formats it inline); if absent, fall back to
-    // stderr so headless invocations (SSH, CI) aren't left waiting
-    // on a browser that never opens.
-    if (options.onAuthUrl) {
-        options.onAuthUrl(authUrl);
-    }
-    else {
-        console.error(`Open this URL to authorize:\n  ${authUrl}`);
-    }
-    const open = options.openBrowser ?? defaultOpenBrowser;
-    open(authUrl);
-    const { code } = await captureCode(OAUTH_CALLBACK_PORT, state);
-    return exchangeAuthCode(config, {
-        clientId: options.clientId,
-        clientSecret: options.clientSecret,
+    const { code } = await captureCode(callback, state, async (signal) => {
+        // Publication may outlive the flow; never launch a finished consent request.
+        if (onAuthUrl)
+            await onAuthUrl(authUrl);
+        else
+            console.error(`Open this URL to authorize:\n  ${authUrl}`);
+        if (!signal.aborted)
+            await openBrowser(authUrl);
+    }, callbackTimeoutMs);
+    return exchangeAuthCode(flowConfig, {
+        clientId,
+        clientSecret,
         code,
         redirectUri,
         codeVerifier: verifier,
+        state,
     });
 }
 // ─── Local callback server ───────────────────────────────────────
-function captureCode(port, expectedState) {
+function listenLoopback(port, handler, onError) {
+    const servers = [];
+    const close = () => {
+        for (const server of servers)
+            server.close();
+    };
+    const listen = (host) => new Promise((resolve, reject) => {
+        const server = createServer(handler);
+        server.once("error", reject);
+        server.listen(port, host, () => {
+            server.removeListener("error", reject);
+            server.on("error", onError);
+            servers.push(server);
+            resolve();
+        });
+    });
+    return (async () => {
+        for (const host of LOOPBACK_HOSTS) {
+            try {
+                await listen(host);
+            }
+            catch (error) {
+                const code = error.code ?? "";
+                if (host !== LOOPBACK_HOSTS[0] && IPV6_UNAVAILABLE.has(code))
+                    continue;
+                close();
+                throw error;
+            }
+        }
+        return servers;
+    })();
+}
+function captureCode(callback, expectedState, onReady, timeoutMs) {
+    if (!Number.isInteger(timeoutMs) ||
+        timeoutMs <= 0 ||
+        timeoutMs > 2 ** 31 - 1) {
+        return Promise.reject(new Error("OAuth: invalid callback timeout"));
+    }
     return new Promise((resolve, reject) => {
-        const server = createServer((req, res) => {
-            const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
-            if (url.pathname !== "/callback") {
-                res.statusCode = 404;
-                res.end("Not found");
+        const lifecycle = new AbortController();
+        let servers = [];
+        const finish = (result) => {
+            if (lifecycle.signal.aborted)
                 return;
-            }
-            const code = url.searchParams.get("code");
-            const state = url.searchParams.get("state");
-            const error = url.searchParams.get("error");
-            if (error) {
-                res.statusCode = 400;
-                res.end(`Authorization failed: ${error}. You can close this tab.`);
+            lifecycle.abort();
+            clearTimeout(timer);
+            for (const server of servers)
                 server.close();
-                reject(new Error(`OAuth: ${error}`));
+            if (result instanceof Error)
+                reject(result);
+            else
+                resolve(result);
+        };
+        const handler = (req, res) => {
+            res.setHeader("Content-Type", "text/plain; charset=utf-8");
+            res.setHeader("Cache-Control", "no-store");
+            let url;
+            try {
+                url = new URL(req.url ?? "/", `http://127.0.0.1:${callback.port}`);
+            }
+            catch {
+                res.writeHead(400).end("Invalid callback");
                 return;
             }
-            if (!code) {
-                res.statusCode = 400;
-                res.end("Missing code");
+            if (req.method !== "GET" || url.pathname !== callback.path) {
+                res.writeHead(404).end("Not found");
                 return;
             }
-            if (state !== expectedState) {
-                res.statusCode = 400;
-                res.end("State mismatch — possible CSRF. Aborting.");
-                server.close();
-                reject(new Error("OAuth: state mismatch"));
+            // Unauthenticated callbacks cannot cancel or complete a pending flow.
+            if (lifecycle.signal.aborted ||
+                url.searchParams.getAll("state").length !== 1 ||
+                url.searchParams.get("state") !== expectedState) {
+                res.writeHead(400).end("State mismatch");
                 return;
             }
-            res.statusCode = 200;
-            res.setHeader("Content-Type", "text/html; charset=utf-8");
-            res.end(`<!doctype html><meta charset="utf-8"><title>Connected</title>` +
-                `<body style="font-family:system-ui;padding:2rem">` +
-                `<h1 style="margin:0 0 0.5rem">Connected \u2713</h1>` +
-                `<p style="color:#666">You can close this tab and return to your terminal.</p>`);
-            server.close();
-            resolve({ code });
-        });
-        server.once("error", reject);
-        server.listen(port, "127.0.0.1");
+            if (url.searchParams.has("error")) {
+                res.writeHead(400).end("Authorization denied. You can close this tab.");
+                finish(new Error("OAuth: authorization denied"));
+                return;
+            }
+            const code = url.searchParams.get("code");
+            if (!code || url.searchParams.getAll("code").length !== 1) {
+                res.writeHead(400).end("Missing or ambiguous code");
+                return;
+            }
+            res.end("Authorization received. Return to your terminal for the connection result.");
+            finish({ code });
+        };
+        const timer = setTimeout(() => finish(new Error("OAuth: browser consent timed out")), timeoutMs);
+        const unavailable = () => finish(new Error("OAuth: callback listener unavailable"));
+        listenLoopback(callback.port, handler, unavailable).then((bound) => {
+            servers = bound;
+            if (lifecycle.signal.aborted) {
+                for (const server of servers)
+                    server.close();
+                return;
+            }
+            void onReady(lifecycle.signal).catch(() => finish(new Error("OAuth: browser launch failed")));
+        }, unavailable);
     });
 }
 // ─── Helpers ─────────────────────────────────────────────────────
@@ -218,8 +316,7 @@ function defaultOpenBrowser(url) {
         detached: true,
     });
     proc.on("error", () => {
-        // Browser failed to open — caller's onAuthUrl prints the URL
-        // so the user can paste it manually.
+        // The displayed consent URL remains available for manual browser navigation.
     });
     proc.unref();
 }

package/dist/credentials/http.d.ts

@@ -0,0 +1,19 @@
+import type { HttpMethod } from "./types.js";
+export interface ResourceOptions {
+    fetch: typeof globalThis.fetch;
+    timeoutMs: number;
+    maxResponseBytes: number;
+    resumableUpload?: boolean;
+}
+/** Internal send primitive. Callers validate destination policy before reaching it. */
+export declare function sendResource(url: string, method: HttpMethod, headers: Headers, body: Buffer | undefined, options: ResourceOptions): Promise<Response>;
+/**
+ * Fetch a provider-issued preauthenticated URL without bearer tokens or cookies.
+ * Hosts approve exact origins and enforce DNS/IP egress through their fetch hook.
+ * The signed URL is itself secret: errors never include it. No redirects or retries.
+ */
+export declare function downloadResource(value: string, options: {
+    allowedOrigins: string[];
+    fetch: typeof globalThis.fetch;
+    maxResponseBytes?: number;
+}): Promise<Response>;